Threat Spotlight: Secret Agent Tesla

Executive Overview

First seen in the wild in 2014, Agent Tesla is .NET compiled and contains an array of powerful infostealing features such as the ability to steal information from a user's browser, passwords, FTP, and files. It was initially available for purchase through a website, agenttesla[dot]com, with the malware’s author offering several fixed-term licenses for its use.

Since then, Agent Tesla infostealer has been consistently utilized by cyber criminals in various nefarious campaigns, often using spam emails as a means of distribution onto victim machines.

More recently, the malware has evolved by being upgraded to contain functionality which allows it to gather information regarding a user's WiFi profile – potentially as a propagation mechanism. Interestingly, this "upgrade" follows a similar upgrade to the Emotet malware variant gaining a "WiFi" spreader module. This seems to be a growing trend among malware authors.

This document contains a technical analysis of a recently seen version of Agent Tesla infostealer uncovered by the BlackBerry Research and Intelligence Team.

Infection Vector

The following infection chain scenario followed an oft-seen infection vector whereby the user is sent a malicious spam email containing an attached weaponized Microsoft® Office document, as seen in the diagram below:

The email itself, titled “WG OFFER REQUEST - DANSON ELECTRONICS.eml”, uses common social engineering techniques to attempt to fool an unwitting user into thinking it is a legitimate document.

Social engineering is a term coined to describe a varied range of malicious activities that may be fulfilled by utilizing psychological manipulation in order to trick an unwitting user into making security related misjudgments, or disclosing sensitive data to the attacker.

An effective tactic is baiting, whereby the user is led to believe that a malicious email is from a legitimate organization and includes time-sensitive information relevant to them or their business.

For example:

In the case of Agent Tesla, the spam email contains an attached malicious .xlsx document – “RFQ 00072165431270-21867223 DALSON.xlsx” – which claims to contain product offer information, when in reality it is weaponized and designed to download a malware payload to the user’s machine.

Upon examination, the document was seen to contain an embedded file “xl/embeddings/oleObject1.bin”, which is an OLE2 archive:

The payload retrieved is named “yu.exe” and correlates to SHA256.

“6BB0872398613515887BE284D81057A12791AC49650AE275A40FBA26F2B12388” was seen to be a sample of Agent Tesla malware. We analyzed the sample and will present our findings over the remainder of this blog.

Additional Campaign Payloads

The host was observed to be serving the following five additional Agent Tesla payloads at the time of the campaign:

• hxxp://hmbwgroup[dot]com/wp-includes/js/tinymce/themes/inlite/ali[dot]exe
• hxxp://hmbwgroup[dot]com/wp-includes/js/tinymce/themes/inlite/fr[dot]exe
• hxxp://hmbwgroup[dot]com/wp-includes/js/tinymce/themes/inlite/thai[dot]exe
• hxxp://hmbwgroup[dot]com/wp-includes/js/tinymce/themes/inlite/bnt[dot]exe
• hxxp://hmbwgroup[dot]com/wp-includes/js/tinymce/themes/inlite/yu[dot]exe

Figure 5: Additional payloads.

Impact

Due to the prevalence and ready availability of the malware described in this scenario, its highly sophisticated nature and the destructive possibilities posed by a successful infection by Agent Tesla, leads this scenario to have a High impact rating.

Taking into consideration that Agent Tesla is tracked and documented closely by the security community, the risk of a successful infection as described above has been designated as Medium.

Agent Tesla File Information

The following sample of the Agent Tesla malware was used for analysis throughout the remainder of this writeup:

Technical Analysis

Upon examination of the sample statically, identification shows it to be a Microsoft® Visual C#® .NET compiled executable and not seen to be packed by any traditional software packers:

Dynamic Analysis

Upon execution, the malware begins by enumerating the host for information such as the active computer name TCP settings and temporary Internet files:

Should this file and folder not be present on the host, the malware continues execution; however, should they both be present, it reads them and checks for the presence of a “Zone.Identifier” file, which is a file that is automatically generated by Internet Explorer along with other utilities when a file/files are downloaded to a Windows® host.

These are utilized by Windows to manage security settings for certain files. They are typically hidden and are not meant to be opened directly. 

Continuing its execution, the malware next enumerates the host for a pre-defined list of specific software and utilities, looking for saved credentials which are saved to a list for later exfiltration.

The first set of utilities are web browsers. Commonly used browsers such as Chromium and Firefox are included along with more uncommon ones such as IceDragon and Waterfox:

A full list of all software seen targeted for credential and information theft can be seen in Figure 42: Targeted software list.

The built-in Windows utility “netsh.exe” – a command-line tool used for the querying of and configuration of network settings – is invoked with the switch “wlan show profile” to list all available WiFi profiles on the network:

Additionally, it can download files from a specified URL, whereby a new WebClient() class is instantiated to provide a means of sending and receiving data to/from specified locations.

In this case, the webclient.download function is used to download a file if requested to a location “GetTempPath,” which may then be executed via the Process.Start method:

Network Analysis

Once it has retrieved all available credentials and other assorted data from a user’s machine for exfiltration, Agent Tesla utilizes the email/SMTP protocol over a hardcoded Port 587.

It begins by setting up an SMTP client – SmtpClient:

The threat actor has an email account registered in advance to receive the stolen data. In order to send the data over SMTP to the server, the pre-registered email account details must be provided.

The compiled exfiltration email contains the following information fields:

• The compromised machine's username, along with host name.
  
• The threat actor's email address for exfiltration to.
  
• The compromised machine's basic information, such as current time, host name, username, OS- FullName, RAM, and CPU.
  
• Any/all stolen information, credentials, keylogged data, etc.:
  

Detection

BlackBerry Protect
With regard to detection, Agent Tesla infostealing malware is blocked by all models of our endpoint protection solution BlackBerry® Protect:

BlackBerry Protect is an AI-based endpoint security solution that prevents breaches and provides added controls for safeguarding against sophisticated threats. Human intervention, cloud connections, an Internet connection, signatures, heuristics, and sandboxes are not required.

Testing

Upon execution of the malware, BlackBerry Protect instantly blocks Agent Tesla from running and causing harm to the machine:

Indicators of Compromise (IoCs)

At BlackBerry, we take a prevention-first and AI-driven approach to cybersecurity. Putting prevention first neutralizes malware before the exploitation stage of the kill-chain. By stopping malware at this stage, BlackBerry solutions help organizations increase their resilience. It also helps reduce infrastructure complexity and streamline security management to ensure business, people, and endpoints are secure.

File Artefacts

Network

Appendices

Mitre Attack Matrix:

Targeted Software

Glossary of Terms

Execution Chain: The series of functional steps or stages a malware performs upon execution.

Spam Email: An unsolicited email often used as a delivery mechanism for malware.

Commodity Malware: Malware that is available for free download or purchase and is not typically customized for the use by threat actors.

Source Code: The code pertaining to a piece of software that has yet to be assembled or compiled into an executable.

Infection Vector: The means of how a piece of malware gained entry to a host or system.

Payload: The portion of a malware that upon execution, causes harm to the host.

Reflective Injection: A stealthy technique for the purpose of injecting and executing code within another process.

Threat Actor: Refers to the person, persons, or group behind a malware or cyberattack.

Emotet: Modular malware variant that began as a standalone banking Trojan but has evolved to add additional functionality. In recent times, Emotet acts as a delivery mechanism for other malware variants.

C&C Servers: Command and control servers (also known as C2 servers), are machines owned and controlled by a threat actor for the purposes of maintaining a flow of communication with compromised hosts on target networks.

Yara Rule

The following Yara rule – Mal_InfoStealer_Win32_Agent_Tesla.yar – was created by the BlackBerry Threat Research Team and tested against the Agent Tesla malware sample contained within this document:

import "pe"
import "math"
import "hash"
import "dotnet"

rule Mal_InfoStealer_Win32_Agent_Tesla
{
meta:
   classification =
   "Malware" subclass =
   "InfoStealer"
   description = "Agent Tesla
   Spyware" structured_tags =
   "None"
   created_from_sha256 = "6BB0872398613515887BE284D81057A12791AC49650AE275A40FBA26F2B12388 "
    author = "The BlackBerry Threat Research Team"

strings:

   $f0 = "ZfPIkXXEALbnWsPbNvwGteOkWxWhexjqOtQxXe.exe" ascii
   $f1 = "v2.0.50727" ascii
   $f2 = ".cctor" ascii
   $f3 = "get_Password" ascii
   $f4 = "get_PasswordHash" ascii
   $f5 = "LLKHF_INJECTED" ascii
   $f6 = "LLKHF_ALTDOWN" ascii
   $f7 = "LLKHF_EXTENDED" ascii
   $f8 = "Thunderbird" ascii 
   $f9 = "Postbox" ascii
   $f10 = "SeaMonkey" ascii
   $f11 = "BlackHawk" ascii
   $f12 = "CyberFox" ascii
   $f13 = "KMeleon" ascii
   $f14 = "IceCat" ascii
   $f15 = "PaleMoon" ascii
   $f16 = "IceDragon" ascii
   $f17 = "WaterFox" ascii
   $f18 = "ZfPIkXXEALbnWsPbNvwGteOkWxWhexjqOtQxXe" ascii
   $f19 = "$0adc3393-8775-4631-8711-602de75e5abe" ascii
   $f20 = "rfearq"

wide condition:

// Must be MZ file
uint16(0) == 0x5a4d
and

// Must be .NET Compiled and contain 5
Streams dotnet.number_of_streams == 5
and

// Must contain s stream called #Blob
for any i in (0..dotnet.number_of_streams
     - 1): (dotnet.streams[i].name ==
     "#Blob") and

// Dotnet version string contained in metadata
root dotnet.version == “v2.0.50727” and

// Must be less
than filesize <
350KB and

// PE Timestamp
pe.timestamp == 0x5E98E4BB and

// Must have exact import hash
pe.imphash() == "f34d5f2d4577ed6d9ceec516c1f5a744" and

// Must have non set and NOT matching
checksum pe.checksum !=
pe.calculate_checksum() and

     // Must have
       Strings all of ($f*)
}
rule Mal_InfoStealer_Win32_Agent_Tesla_B
{
   meta:
     classification = "Malware" subclass = "InfoStealer"
     description = "Agent Tesla Spyware" structured_tags = "None"
     created_from_sha256 = "6BB0872398613515887BE284D81057A12791AC49650AE275A40FBA26F2B12388 "
     author = "The BlackBerry Threat Research Team"

strings:
   $f1 = "v2.0.50727" ascii
   $f2 = ".cctor" ascii
   $f3 = "get_Password" ascii
   $f4 = "get_PasswordHash" ascii
   $f5 = "LLKHF_INJECTED" ascii
   $f6 = "LLKHF_ALTDOWN" ascii
   $f7 = "LLKHF_EXTENDED" ascii
   $f8 = "Thunderbird" ascii
   $f9 = "Postbox" ascii
   $f10 = "SeaMonkey" ascii
   $f11 = "BlackHawk" ascii
   $f12 = "CyberFox" ascii
   $f13 = "KMeleon" ascii
   $f14 = "IceCat" ascii
   $f15 = "PaleMoon" ascii
   $f16 = "IceDragon" ascii
   $f17 = "WaterFox"

ascii condition:

// Must be MZ file uint16(0) == 0x5a4d and
// Must be .NET Compiled and contain 5
Streams dotnet.number_of_streams == 5 and

// Must contain s stream called #Blob
for any I in (0..dotnet.number_of_streams
- 1): (dotnet.streams[i].name ==
"#Blob") and

// Must have exact import hash
pe.imphash() == "f34d5f2d4577ed6d9ceec516c1f5a744" and

// Must have non set and NOT matching
checksum pe.checksum !=
pe.calculate_checksum() and

     // Must have
     Strings all of ($f*)
}

References

• https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html
• https://www.bleepingcomputer.com/news/security/hackers-steal-wifi-passwords-using-upgraded-agent-tesla-malware/
• https://www.itproportal.com/news/agent-tesla-malware-receives-module-for-stealing-wi-fi-passwords/
• https://r00tten.com/in-depth-analysis-rtf-file-drops-agent_tesla
• https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla
  
  

BlackBerry Assistance

If you’re battling an Agent Tesla attack or a similar threat, you’ve come to the right place, regardless of your existing BlackBerry relationship.

The BlackBerry Incident Response team is made up of world-class consultants dedicated to handling response and containment services for a wide range of incidents, including ransomware and Advanced Persistent Threat (APT) cases.

We have a global consulting team standing by to assist you providing around-the-clock support, where required, as well as local assistance. Please contact us here: https://www.blackberry.com/us/en/forms/cylance/handraiser/emergency-incident-response-containment